{"record":{"id":"3fbb9275890beff2","repo":"chenhg5/cc-connect","slug":"listen-for-agy-permission-hooks-w","errorCode":null,"errorMessage":"listen for Agy permission hooks: %w","messagePattern":"listen for Agy permission hooks: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agent/antigravity/permission_bridge.go","lineNumber":70,"sourceCode":"\tbridgeCtx, cancel := context.WithCancel(ctx)\n\trootDir, err := os.MkdirTemp(\"\", \"cc-connect-agy-permission-\")\n\tif err != nil {\n\t\tcancel()\n\t\treturn nil, fmt.Errorf(\"create permission bridge directory: %w\", err)\n\t}\n\n\tconfigDir, err := createAgyConfigOverlay(rootDir)\n\tif err != nil {\n\t\tcancel()\n\t\t_ = os.RemoveAll(rootDir)\n\t\treturn nil, err\n\t}\n\n\tlistener, err := net.Listen(\"tcp\", \"127.0.0.1:0\")\n\tif err != nil {\n\t\tcancel()\n\t\t_ = os.RemoveAll(rootDir)\n\t\treturn nil, fmt.Errorf(\"listen for Agy permission hooks: %w\", err)\n\t}\n\n\ttokenBytes := make([]byte, 32)\n\tif _, err := rand.Read(tokenBytes); err != nil {\n\t\tcancel()\n\t\t_ = listener.Close()\n\t\t_ = os.RemoveAll(rootDir)\n\t\treturn nil, fmt.Errorf(\"generate permission bridge token: %w\", err)\n\t}\n\n\tbridge := &agyPermissionBridge{\n\t\tctx:       bridgeCtx,\n\t\tcancel:    cancel,\n\t\tlistener:  listener,\n\t\taddress:   listener.Addr().String(),\n\t\ttoken:     base64.RawURLEncoding.EncodeToString(tokenBytes),\n\t\trootDir:   rootDir,\n\t\tconfigDir: configDir,","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/chenhg5/cc-connect/blob/4000b2338aa6e850c99df54f8b0ed6ed7460b401/agent/antigravity/permission_bridge.go#L52-L88","documentation":"newAgyPermissionBridge sets up a local TCP listener used as a permission-hook bridge for the Antigravity agent. If net.Listen on 127.0.0.1:0 fails, the bridge cannot receive hook callbacks, so construction aborts with this wrapped error. This wraps the underlying OS listen error.","triggerScenarios":"Calling newAgyPermissionBridge (directly in tests, or via newAntigravitySession when an Antigravity session starts) when no TCP listener can be created on the loopback interface, e.g. loopback networking unavailable or socket file descriptor exhaustion.","commonSituations":"Containers/sandboxes with networking disabled (network namespace without loopback), rlimits on open file descriptors exhausted (EMFILE), hardened seccomp profiles blocking socket creation, or Windows firewall/AV blocking socket binds.","solutions":["Verify loopback networking is enabled in the environment (check for 'net lo up' / no network namespace isolation) and retry.","Check the process file descriptor limit (ulimit -n) and raise it if EMFILE is the wrapped cause.","Inspect the wrapped error for errno: EADDRNOTAVAIL/EACCES usually means sandbox/network policy; adjust the sandbox to allow binding 127.0.0.1.","Run cc-connect in an environment that permits TCP sockets (disable seccomp/AppArmor restrictions for the agent process)."],"exampleFix":"// diagnosing\nerr := startAgent()\nfmt.Println(err) // listen for Agy permission hooks: listen tcp 127.0.0.1:0: bind: ... \n// before (sandbox without loopback)\ndocker run --network none cc-connect ...\n// after\ndocker run --network bridge cc-connect ...","handlingStrategy":"try-catch","validationCode":"// Go: probe loopback bindability before starting a session\nln, err := net.Listen(\"tcp\", \"127.0.0.1:0\")\nif err != nil { return fmt.Errorf(\"loopback unavailable: %w\", err) }\nln.Close()","typeGuard":null,"tryCatchPattern":"if err := startAntigravitySession(); err != nil {\n    var netErr *net.OpError\n    if errors.As(err, &netErr) && strings.Contains(err.Error(), \"listen for Agy permission hooks\") {\n        // fall back to an agent without the permission bridge or surface a network-sandbox hint\n    }\n}","preventionTips":["Run cc-connect in environments where loopback TCP is permitted (not --network none).","Keep file descriptor limits generous (ulimit -n 4096+).","Smoke-test listener creation in health checks before starting agent sessions."],"tags":["network","tcp-listener","antigravity","go"],"backgroundTag":"connection-refused","analyzedSha":"4000b2338aa6e850c99df54f8b0ed6ed7460b401","analyzedAt":"2026-09-06T11:45:09.575Z","contentChangedAt":"2026-09-06T11:45:09.575Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}